CVE-2025-9208
MEDIUMOpenText Web Site Management Server 16.7.X-16.8.1 - XSS
Title source: llmDescription
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored XSS. The vulnerability could execute malicious scripts on the client side when the download query parameter is removed from the file URL, allowing attackers to compromise user sessions and data. This issue affects Web Site Management Server: 16.7.X, 16.8, 16.8.1.
Exploits (1)
github
WRITEUP
by MarioTesoro · poc
https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-9208
Scores
CVSS v3
5.4
EPSS
0.0001
EPSS Percentile
1.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
opentext/web_site_management_server
< 16.8.1
Published
Feb 19, 2026
Tracked Since
Feb 20, 2026